during the service() method of any servlet in the web application, during the doFilter() method of any servlet
filter and when the container calls any HttpSessionListener, AsyncListener or
ServletRequestListener.

The session context is shared between all servlet requests that occur in the same HTTP session. The session context is
destroyed when the HTTPSession times out, after all HttpSessionListeners have been called, and at the very end of
any request in which invalidate() was called, after all filters and ServletRequestListeners have been
called.